WE CLAIM: 

1. A secure component-bas id operating process including: 

(a) retrieving at least one component; 

(b) retrieving a record that specifies a component assembly; 

(c) checking said component and/or said record for validity; 

(d) using said component tf> form said component assembly 
in accordance with said record; and 

(e) performing a process Based at least in part on said 
component assembly. 

2. A process as in claintf 1 wherein said step (c) comprises 
executing said component assembly. 


3. A process as in claiin 1 
comprises executable code 

4. A process as in clapn 
comprises a load module. 


aid component 



in said component 


5. A process as in cl£im 1 wherein: 
said record comprise 

(i) directions/for assembling said component 

assembly; 

(ii) information that at least in part specifies a 
control; anc 

said process further comprises controlling said step (d) 
and/or said step (e) based at least in part on said control. 


6. A process as in claim 1 wherein said component has a 
security wrapper, ana said controlling step comprises selectively 
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data indicating that a given movie, sang, channel, game, etc. was 
R rated and allowing a parent to restrict viewing or listening). 
Such a control location may, for example, also gather information 
on consumption of water, gas, elecfticity, telephone usage, etc. 
(either through use of PPEs 650 integrated in control means for 
measuring and/or controlling such consumption, or through one or 
more signals generated by noif-VDE systems and delivered to a 
VDE secure subsystem, for Acample, for processing, usage control 
(e.g. usage limiting), and/a/ billing), transmit such information to 
one or more utilities, pa/for such consumption using VDE secured 
electronic currency andyor credit, etc. 

In addition, or/e or more budgets Tor usage could be managed 
by VDE which would prevent jAproper, excessive use of a certain, 
leased appliance, jihat might, /or example lead to failure of the 
appliance, such Js making fat more^pte^jising^a photocopier 
than specified by the duty cy&texSuch improper use could result 
in a message, for example on a display panel or television screen, 
or in the form of a communication from a central clearinghouse, 
that the user should upgrade to a more robust model. 


lie the invention has been described in connection with 
what is presently considered to be the most practical and preferred 
embodiment, it is to be understood that the invention is not to be 
limited! to the disclosed embodiment, but on the contrary, is 
intended to cover various modifications and equivalent 

igements included within the spirit and scope of the appended 
claims. 
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3 opening said security wrapper baslfed at least in part on said 

4 control. / 

1 7. A process as in claim 1 J wherein: 

2 said permissions record infcludes at least one decryption key; 

3 and / 

4 said controlling step inc/udes controlling use of said 

5 decryption key. / 

1 8. A process as in claim 1 including performing at least two 

2 of said steps (a) and (e) within a protected processing environment. 

1 9. A process as in claim 1/mclu^ing performing at least two 

2 of said steps (a) and (e) at leas^ in part within tamper-resistant 

3 hardware. / / 

1 10. A method as id (Claim 1 wfterein said performing step (e) 

2 includes metering usage/ / / \ 

1 11. A method as in claim 1 wherein said performing step (e) 

2 includes auditing usage. 
1 / 

1 12. A method as in claim 1 wherein said performing step (e) 

2 includes budgeting udage. 

1 13. A secure domponent operating system process including: 

2 receiving a component; 

3 receiving directions specifying use of said component to form 

4 a component assembly; 
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authenticating said received conjlponent and/or said 
directions; 

forming, using said component/ said component assembly 
based at least in part on said received directions; and 

using said component assembly to perform at least one 
operation. 


14. A method comprising performing the following steps 
within a secure operating system ^environment: 
providing code; 

providing directions speci$dng assembly of said code into an 
executable program; 

checking said received c^de and/or said assembly directors 
for validity; and 

in response to occurrence of an e/fent, assembling said code 


in accordance with said rec 
assembly for execution. 


ived assembly directions to form an 


» 

L^Ves 


15. A method for Managing kt lej^one^esoim^wrth a 
secure operating environment, said method comprising: 

securely receiving a first control from a first entity external 
to said operating environment; 

securely receiving a second control from a second entity 
external to said operating environment, said second entity being 
different from said first entity; 

securely processing, using at least one resource, a data item 
associated with said first and second controls; and 


securely ap; 


said resource for i lse with said data item. 


lying said first and second controls to manage 
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1 16. A method for securely managing at least one operation 

2 on a data item performed at least in p^rt by an electronic 

3 arrangement, said method comprising 

4 (a) securely delivering a first pifocedure to said electronic 

5 arrangement; 

6 (b) securely delivering, to said/electronic arrangement, a 

7 second procedure separable or separate from said first procedure; 

8 (c) performing at least one operation on said data item, 

9 including using said first and seobnd procedures in combination to 
10 at least in part securely managrf said operation; and 

H (d) securely conditioning at least one aspect of use of said 

12 data item based on said delivering steps (a) and (b) having 

13 occurred. 

1 17. A method as in tlaim 16 includingyperforming said 

2 delivering step (b) at a trjtie different from the time said delivering 

3 step (a) is performed. 


1 
2 
3 
4 


18. A method a£ in claim 16 >^rei^aid^ste^^ 
delivering said first proceduife fr^aa i first source, and said step (b) 
includes delivering said second procedure from a second source 
different from said/first source. 


1 19. A method as in claim 16 further including ensuring the 

2 integrity of said/first and second procedures. 


1 20. A mJbthod as in claim 16 further including validating 

2 each of said first and second procedures. 
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21. A method as in claim 16 further including 
authenticating each of said first and second procedures. 


22. A method as in claim 16 Wherein said using step (c) 
includes executing at least one of said first and second procedures 
within a tamper-resistant environment. 

23. A method as in claim 16 wherein said step (c) includes 
the step of controlling said data ^tem with at least one of said first 
and second procedures. 

24. A method as in claim 16 further including establishing a 
relationship between at least one of said^nrstWd second 
procedures and said data j/tem. 

25. A method as ik claim 18 further including establishing 
correspondence between said datp item and At least one of said 
first and second procedures. 

26. A method ks in claim 16 wherein said delivering step (b) 
comprises delivering at least one load module encrypted at least in 
part. 

27. A metMod as in claim 26 wherein said delivering step (a) 
comprises delivering at least one further load module encrypted at 
least in part. 


28. A method as in claim 16 wherein said delivering step (b) 
comprises delivering at least one content container carrying at 
least in part/encrypted control information. 
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29. A method as in claim 16 whetein said delivering step 
(b) comprises delivering a control method and at least one further 
method. 

30. A method as in claim 16 Wherein said delivering step (a) 
includes: 

encrypting at least a portion Li said first procedure, 

communicating said at least/ in part encrypted first 
procedure to said electronic arrangement, 

decrypting at least a portion of said first procedure at least 
in part using said electronic arrangement, and 

validating said first procedure with said electronic 
arrangement. 

31. A method as in/claim 16 therein s\rid delivering step (b) 
includes delivering at lea4t one of /aid first aifd second procedures 
within an administrative object. 

32. A method ai in claim 16 wherein said delivering step (b) 
includes codelivering/said second procedure in at least in part 
encrypted form with/said data item. 

33. A metho/l as in claim 16 wherein said performing step 
includes metering/usage. 

34. A method as in claim 16 wherein said performing step 
includes auditing usage. 


35. A method as in claim 16 wherein said performing step 
includes budgeting usage. 
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! 36. A method for securely managing at least one operation 

2 performed at least in part by a secure/ electronic appliance, 

3 comprising: / 

4 (a) selecting an item that is protected with respect to at 

5 least one operation; / 

6 (b) securely independently delivering plural separate 

7 procedures to said electronic appliance; 

8 (c) using said plural separate procedures in combination to 

9 at least in part securely manag</ said operation with respect to 
10 said selected item; and / 

n (d) conditioning successful completion of said operation on 

12 said delivering step (b) haviiig occurred. 

1 37. A method for processing based ofTindependent 

2 deliverables comprising: / / ^ 

3 securely delivering a first piece /f code defining a first part 

4 of a process; / I J\ ^ 
■ 5 separately, security deliveringja secphd piec£J>f-e(5de 

6 defining a second paruof said process, - 

7 ensuring the integrity of the first and second delivered 

8 pieces of code; and / 

9 performing said process based at least in part on said first 

10 and second delivered code pieces. 

1 38. A methpd as in claim 37 wherein a first piece of code for 

2 said process at leist in part controls decrypting content. 

1 39. A metpod as in claim 37 wherein said ensuring step 

2 includes validating said first and second pieces of code. 
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40. A method as in 
includes validating said first 
one another. 


claiim 37 wherein said ensuring step 
ind second pieces of code relative to 


41. A method as in 
includes metering usage. 


ch im 37 wherein said performing step 


42. A method as in cljum 37 wherein said performing step 
includes auditing activities., 

43. A method as inyblaim 37 wherein said performing step 
includes budgeting usag<= 

44. A method as /in claim 3^herein said performing step 
includes electronically jfcrocessijtfg content^ased on electronic 
controls. 

45. A method if securely controjlin^at least one protected 
operation with respect to a data itejaa comprisii 

(a) supplying/at least Vfirst control from a first party; 

(b) supplying at least a second control from a second party 
different from said first party; 

(c) securely </ombining said first and second controls to form 
a set of controls; 

(d) securel^ associating said control set with said data 

item; and 

(e) securely controlling at least one protected operation with 
respect to said dfata item based on said control set. 
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1 
2 
3 

1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 


46. A method as in claim 45 where/n said data item is 
protected. 

47 A method as in claim 45 wherein at least one of said 
plural controls includes a control relating to metering at least one 
aspect of use of said protected data item. 

48. A method as in claim 45/ wherein at least one of said 
plural controls include a control relating to budgeting at least one 
aspect of use of said protected data item. 

49. A secure method for combining data items into a 
composite data item comprisii 

(a) securely providing a/first data item having at least a first 
control associated therewith;] 

(b) securely providing a second data item having at least a 
second control associated therewith; 


(c) forming a composite 

(d) securely combining 
composite control set; an. 

(e) performing at/least 
said first and second d^ta ite 
composite control set 



'and second data items; 
second controls into a 


leration on said composite of 
it least in part on said 


1 
2 
3 

1 
2 


50. A method ks in claim 49 wherein said combining step 
includes preserving $ach of said first and second controls in said 
composite set. 


51. A methoc 
comprises governin \ 


as in claim 49 wherein said performing step 
the operation on said composite of said first 
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3 and second data items in accordance with said first control and 

4 said second control . / 

1 52. A method as in claim 49 wherein said providing step 

2 includes ensuring the integrity of said association between said 

3 first controls and said first data item iar maintained during at least 

4 one of transmission, storage and processing of said first data item. 

1 53. A method as in claim 49 wherein said providing step 

2 comprises delivering said first dfata item separately from said first 

3 control . / 

1 54. A method as in/claim 49 wherein said providing step 

2 comprises codelivering Said first data item and said first control . 

1 55. A secure inethod for controlling a protected operation 

2 comprising: / / 

3 (a) delivering at least a first contarol and a second control; 

4 and / l /^^*^_^^^ 

5 (b) controlling at least unprotected operation based at least 

6 in part on L combination of said first and second controls, 

7 including' at least one of the following steps: 

8 / resolving at least one conflict between said first and 

9 second controls based on a predefined order; 

10 / providing an interaction with a user to form said 

11 conpination; and 

12 / dynamically negotating between said first and second 

13 controls. 

w 
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56. A method as in claim 55 wherein said controlling step 
(b) includes controlling decryption of electronic content. 

57. A method as in claim 55 further including: 
receiving protected electronic content from a party; and 
authenticating the identity of said party prior to using said 

received protected electronic conte/nt. 


58. A secure method con/prising: 
selecting protected dat 

extracting said protected data from an object; 
identifying at least one control to manage at least one aspect 
of use of said extracted data; 

placing said extracted data into a further object; and 
associating saicyat least one control with said further object. 

59. A method as in clajfn 58 further including limiting at 
least one aspect use of sajti further object based on said at least 
one control. 

60. A/secure method of modifying a protected object 
comprising 

(a) providing a protected object; and 
(b/ embedding at least one additional element into said 
protected object without unprotecting said object. 



61. A method as in claim 60 further including: 
associating at least one control with said object; and 
limiting usage of said element in accordance with said 


control 
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1 62. A method as in claim 60 further including including a 

2 permissions record within said object. / 

1 63. A method as in claim 61 further including at least in 

2 part encrypting said object. / 

1 64. A method for managing aft least one resource with a 

2 secure operating environment, said method comprising: 

3 securely receiving a first Ic/ad module from a first entity 

4 external to said operating environment; 

5 securely receiving a second load module from a second entity 

6 external to said operating eiwironment, said second entity being 

7 different from said first entity; 

8 securely processing, using at least one resource, a data item 

9 associated with said first and secOTrfTload modules; and 

10 securely applying said fim and second load modules to 

11 manage said resource fdr use with saici\ data item. 

1 65. A method wr negotiating^ectrotu£contracJs; 

2 comprising: / 

3 receiving a firat control set from a remote site; 

4 providing a second control set; 

5 performing, within a protected processing environment, an 

6 electronic negotiation between said first control set and said 

7 second control sett including providing interaction between said 
. 8 first and second control sets; and 

9 producing i negotiated control set resulting from said 

10 interaction betw sen said first and second control sets. 

1 66. A system for supporting electronic commerce including: 
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2 means for creating a first secure contpl set at a first 

3 location; 

4 means for creating a second secure ytontrol set at a second 

5 location; 

6 means for securely communicating said first secure control 

7 set from said first location to said second location; and 

8 means at said second location tor securely integrating said 

9 first and second control sets to prod/lice at least a third control set 

10 comprising plural elements togeth/r comprising an electronic value 

11 chain extended agreement. 

1 67. A system for supporting electronic commerce including: 

2 means for creating a fir^t secure control set at a first 

3 location; 

4 means for creating a second secure c6n^h^l set at a second 

5 location; 

6 means for securely communicating saidffirst secure control 

7 set from said first location to said second location; and 

8 negotiation means /at said second locatiot^for negotiating an 

9 electronic contract through secure execution of at least a portion of 
10 said first and second secure control sets. 

1 68. A system as in claim 67 further including means for 

2 controlling use by aAiser of protected information content based on 

3 at least a portion of said first and/or second control sets. 


1 69. A systein as in claim 67 further including means for 

2 charging for at least a part of said content use. 

1 70. A secure component-based operating system including: 
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component retrieving means for retrieving at least one 
component; 

record retrieving means for retrie^ng a record that specifies 
a component assembly; 

checking means, coupled to sait^component retrieving means 
and said record retrieving means, for/checking said component 
and/or said record for validity; 

using means, coupled to saicVchecking means, for using said 
component to form said componegft assembly in accordance with 
said record; and 

performing means, coupled to said using means, for 
performing a process based ap least in part on said component 
assembly. 


71. A secure component-based operating system including: 

a database manager that retrieves, from a secure database, 
at least one component/and at leapfone record that specifies a 
component assembly; 

an authenticating manager th^$hec£s^s£id component 
and/or said record fpr validity;^/ 

a channel manager that uses said component to form said 
component assenply in accordance with said record; and 

an execution manager that performs a process based at least 
in part on said component assembly. 


72. A secure component operating system including: 
means for receiving a component; 


means 
component 


for receiving directions specifying use of said 
form a component assembly; 


X 
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means, coupled to said receiving means, for authenticating 
said received component and/or said directions; 

means, coupled to said authenticating means, for forming, 
using said component, said component ;/sembly based at least in 
part on said received directions; and 

means, coupled to said forming rfaeans, for using said 
component assembly to perform at least one operation. 


73. A secure component operating environment including: 

a storage device that stores/a component and directions 
specifying use of said components to form a component assembly; 

an authenticating manager that authenticates said 
component and/or said directions; 

a channel manager that forms, usimj_said component, said 
component assembly based at least in part on^said directions; and 

a channel that executes said component assembly to perform 
i t least one operation. 


74. A secure operfiting systefea-efivironment comprising: 

a storage device that stores code and directors specifying 
assembly of said code Anto an executable program; 

a validating deface that checks said received code and/or 
said assembly directors for validity; and 

an event-driven channel that, in response to occurrence of 
an event, assembles said code in accordance with said assembly 
directions to form/an assembly for execution. 



75. A sectire operating environment system for managing at 
least one resoun e comprising: 
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3 a communications arrangement that securely receives a first 

4 control from a first entity external to said operating environment, 

5 and securely receives a second con rol from a second entity 

6 xternal to said operating environment, said second entity being 

7 different from said first entity; an< 

8 a protected processing environment, coupled to said 

9 communications arrangement, that: 

10 (a) securely processes, using at least one resource, a 

11 data item associated with said first and second controls, and 

12 (b) securely applies said first and second controls to 

13 manage said resource for use/of said data item. 


1 76. A system for negotiating electronic contracts, 

2 comprising: 

3 a storage arrangement th?(t that storey a first control set 

4 received from a remote site, and stores a second control set; 

5 a protected processing /environment, coupled to said storage 

6 arrangement, that: 

7 (a) performs an^ectronib^iegotiatiefi between 

8 said first control set and said second control set, 

9 (by provides interaction between said first and 

10 second control sets, and 

11 (1) produces a negotiated control set resulting 

12 from said interaction between said first and second control sets. 


1 
2 


77. Asysl 


electronically enf >rcing said negotiated control set. 


as in claim 76 further including means for 
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78. A system as in claim 76 further including means for 
generating an electronic contract bas^d on said negotiated control 
set. 

79. A method for supporting ilectronic commerce including: 
creating a first secure control set at a first location; 
creating a second secure coritrol set at a second location; 
securely communicating ssud first secure control set from 

said first location to said second location; and 

electronically negotiating, at said second location, an 
electronic contract, including/the step of securely executing at least 
a portion of said first and second secure control sets. 

80. An electronic aj 
a processor; and 
at least one memoi 
wherein said procfessc 

retrieving meaAs fpfr retrieving at least one 
component, and at least one record that specifies a component 
assembly, from said memory device, 

checking means coupled to said retrieving means for 
checking siad competent and/or said record for validity, and 

using means coupled to said retrieving means for 
using said component to form said component assembly in 
accordance with spid record. 

81. An electronic appliance comprising: 
at least onfe processor; 

at least one memory device connected to said processor; and 



frocessor; 


782 


# 


at least one input/output connection coupled to said 
processor, 

wherein said processor at least in part executes a rights 
operating system to provide a secure operating environment within 
said electronic appliance. 

82. An electronic appliance as in claim 81 wherein said 
processor includes means for providing a channel, said channel 
assembling independently deliverable components into a 
component assembly and executing said component assembly. 


83. An electronic appliance as in claim 81 further including 
a secondary storage device coupled to said processor, said 
secondary storage device /storing a secure database, said processor 
including means for decryting k^formktpn obtained from said 
secure database and fo/ encnnrting information to be written to 
said secure database. 



84. An electrdhic ^ppli^ce as^!t«teim81 wherein said 
processor and said memory device are disposed in a secure, 
tamper-resistance Encapsulation. 


85. An electronic appliance as in claim 81 wherein said 
processor includes a hardware encryptor/decryptor. 


86. An electronic appliance as in claim 81 wherein said 
processor includes a real time clock. 


87. An 
processor 


electronic appliance as in claim 81 wherein said 
includes a random number generator. 
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88. An electronic appliance as in cla/m 81 wherein said 
memory device stores audit information. 

89. A method for auditing the us4 of at least one reso. xce 
with a secure operating environmentJsaid method comprising: 

securely receiving a first control from a first entity external 
to said operating environment; 

securely receiving a second/control from a second entity 
external to said operating environment, said second entity being 
different from said first entity 

using at least one resource; 

securely sending to said first entity in accordance with said 
first control, first audit information concerning use of said 
resource; and 

securely sending/to said second entity in accordance with 
said second control, s/cond audit information concerning use of 
said resource, said s/cond audit informatjbn being at least in part 


different from saidmrst audit 


informatw 


90. A method for auditihg^he use of at least one resource 
with a secure operating environment, said method comprising: 

securely/receiving first and second control alternatives from 
an entity external to said operating environment; 

selecting one of said first and second control alternatives; 
using/at least one resource; 

if said first control alternative is selected by said selecting 
step, securely sending to said entity in accordance with said first 
control alternative, first audit information concerning use of said 
resource and 
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if said second control alternative is selected by said selecting 
step, securely sending to said second^entity in accordance with 
said second control alternative; second! audit information 
concerning use of saiu resource, said!! second audit information 
being at least in part different from said first audit information. 
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